CCI-005035

Remove personally identifiable information elements from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Implementation Guidance

Determine if personally identifiable information elements are removed from a dataset prior to its release if those elements in the dataset do not need to be part of the data release.

Validation Procedures

Examine: [SELECT FROM: System and information integrity policy; system and information integrity procedures; personally identifiable information processing policy; de-identification procedures; procedures for minimizing the release of personally identifiable information; system configuration; data release mechanisms; system security plan; privacy plan; privacy impact assessment; privacy risk assessment documentation; other relevant documents or records]. Interview: [SELECT FROM: Organizational personnel responsible for de-identifying the dataset; organizational personnel with information security and privacy responsibilities]. Test: [SELECT FROM: Automated mechanisms supporting and/or implementing the removal of personally identifiable information elements from a dataset].

The controls below (if any) were marked by NIST as being related to CCI-005035.